[frogblast]

I was wondering if a “chain of custody” law for personal information can make this enforceable.

You can request your personal information from a holder of it, and along with that comes the identity of where/when/who that data was acquired from (and transitively who they got it from).

Then you can tell who sold it, both to gauge violations and also to name and shame.

And if they don’t have the chain of custody, then they are immediately in violation, and it is easily proven.